CVE-2018-1311 is a high-severity use-after-free vulnerability in the Apache Xerces-C XML parser (versions 3.0.0 to 3.2.3), affecting products from vendors like Apache, Debian, Fedora, Oracle, and Red Hat. This flaw, triggered during external DTD scanning, carries a CVSS score of 8.1, indicating a high potential for impact on confidentiality, integrity, and availability, with a network attack vector and high attack complexity. There is no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage, suggesting it is not currently a widely targeted vulnerability. The only current mitigation is to disable DTD processing.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 3.0.0, < 3.2.5CPE matchmatch criteria | cpe:2.3:a:apache:xerces-c\+\+:*:*:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* | ||
7.7CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
HP ThinPro 8.0 SP 9 Security Updates
Jun 17, 2024HP ThinPro 8.0 SP 9 Security Updates
Jun 17, 2024HP ThinPro 8.1 SP 2 Security Updates
Apr 12, 2024HP ThinPro 8.1 SP 2 Security Updates
Apr 12, 2024CVE-2018-1311
Apr 12, 2022xerces-c: XML parser contains a use-after-free error triggered during the scanning of external DTDs
Dec 16, 2019The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature or via SAX using the XERCES_DISABLE_DTD environment variable.
Dec 10, 2019